ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain onepay114.top.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1811967
IOC: onepay114.top
IOC Type :domain
Threat Type :cc_skimming
Malware: magecart
Confidence Level : Confidence level is high (90%)
Is compromised? : False
ASN:AS48753 GOOGLE-CLOUD-PLATFORM
Country:- US
First seen:2026-05-14 12:35:43 UTC
Last seen:never
UUID:3d08bf19-4f06-11f1-b930-42010aa4000a
Reporter cottaflora
Reward 5 credits from ThreatFox
Tags:GorgonAgora medusajs PaymentVanilla web-skimmer

Avatar
cottaflora
GorgonAgora card skimming network. 23 skimmer domains from TLS cert on 80.97.160.51 (AlexHost, Moldova, AS48753). Custom SDK (PaymentVanilla) creates fake Stripe iframe, exfils card data via AES-256-GCM over WebSocket with real-time 3DS relay. 4880+ fake storefronts impersonating real brands.